malware

Posted by bobbyn

tlsloader.py is python script that can be used as a PyCommand within Immunity Debugger to load a PE file, set breakpoints on all TLS callback functions, and stop execution at the first TLS callback function. Just place it within the PyCommands directory and type "!tlsloader <path_to_file>" in the command box to run it. Additional details will be written to the Log window (Alt + L).

Usage of this PyCommand requires you to configure the debugger to make its first pause at the system breakpoint (which not the default setting). To make this change, go to "Options" -> "Debugging options" -> [Events]. I don't believe that the python API allows me to do this automatically (or at least I didn't find it).

If the PE file doesn't contain any TLS callback functions, execution will be paused at the entry point as defined in the PE header. Note: this script does not currently work on DLLs.
 

Continue reading...
Posted by bobbyn

openfh.py is a python script that can be used as a PyCommand within Immunity Debugger to open a file handle under the debugged process.  Just place it within the PyCommands directory and type "!openfh <path_to_file>" in the command box to run it.

The new file handle will be shown in the message box at the bottom of the window and additional details will be written to the Log window (Alt + L). Registers and CPU status flags should all be preserved.

Continue reading...